WO2020135232A1

WO2020135232A1 - Malicious sample detection method, apparatus and system, and storage medium

Info

Publication number: WO2020135232A1
Application number: PCT/CN2019/126752
Authority: WO
Inventors: 周海生; 马苏安; 郝林成; 徐洲
Original assignee: 中兴通讯股份有限公司
Priority date: 2018-12-26
Filing date: 2019-12-19
Publication date: 2020-07-02
Also published as: CN111368295A

Abstract

Disclosed are a malicious sample detection method, apparatus and system and a storage medium. The method comprises: starting a time shift mode of a virtual machine, and acquiring a record log of a detected sample in the time shift mode of the virtual machine (S1); analyzing whether there is malicious behavior in the record log in the time shift mode (S2); and if there is malicious behavior in the record log, determining a time dimension latent behavior type of the detected sample according to the type of time shift mode (S3).

Description

Malicious sample detection method, device, system and storage medium

This disclosure claims the priority of the Chinese patent application CN201811604795.1, entitled "Malicious Sample Detection Method, Device, System, and Storage Media," filed on December 26, 2018, the entire contents of which are incorporated herein by reference.

Technical field

The present disclosure relates to the technical field of network security, and in particular, to a malicious sample detection method, device, system, and storage medium.

Background technique

The advent of the Internet era has brought great convenience to people’s lives, studies and work, but it is also accompanied by more and more important network security issues. More and more malicious software is rampant on the network, which is Life, study and work have brought a lot of hidden dangers, and major security vendors are seeking better ways to detect malicious files.

In some cases, the dynamic behavior analysis of malicious samples is an analysis method that runs malicious samples in a real computer operating environment and analyzes the log information to identify malicious samples. However, most of the current malware, viruses or backdoors have the latent feature of time dimension, that is, they will not perform malicious operations immediately after infecting the host machine, but will be latent to run for a period of time before performing malicious behavior, dynamic behavior analysis The analysis time is fixed and relatively short, which makes it difficult to capture malicious behaviors of malicious samples, unless a large amount of useless waiting time is consumed to increase the accuracy of analysis in a way that reduces efficiency. Even so, some malicious people with long-term latent behaviors The sample, because it is impossible to wait indefinitely, cannot obtain its malicious behavior.

Summary of the invention

The main purpose of the present disclosure is to provide a malicious sample detection method, device, system, and storage medium, which are designed to quickly trigger the time latent behavior of malicious samples through time shifting, and improve the efficiency and success rate of malicious sample dynamic behavior analysis.

In order to achieve the above object, the present disclosure provides a malicious sample detection method, which is applied to a virtual machine. The malicious sample detection method includes the following steps: when the time-variable mode of the virtual machine is started, the measured object is obtained A log of the sample in the time-variable mode of the virtual machine; analyze whether the log in the time-variable mode has malicious behavior; if the log has malicious behavior, then judge according to the type of the time-variable mode The type of latent behavior in the time dimension of the tested sample.

The present disclosure also provides a malicious sample detection device. The malicious sample detection device includes an acquisition module, an analysis module, and a determination module, wherein: the acquisition module 10 activates the time-variable mode of the virtual machine and acquires the tested sample in the virtual The log in the time-variable mode of the computer; the analysis module 20 analyzes whether the log in the time-variable mode has malicious behavior; the determination module 30, if the log has malicious behavior, according to the time-variable mode The type determines the type of latent behavior in the time dimension of the tested sample.

In addition, in order to achieve the above object, the present disclosure also provides a malicious sample detection system. The malicious sample detection system includes: a memory, a processor, and a malicious sample detection stored on the memory and operable on the processor Program, when the malicious sample detection program is executed by the processor, the steps of the malicious sample detection method described above are implemented.

In addition, to achieve the above object, the present disclosure also provides a storage medium on which a malicious sample detection program is stored, and when the malicious sample detection program is executed by the processor, the steps of the malicious sample detection method described above are implemented .

BRIEF DESCRIPTION

FIG. 1 is a schematic diagram of a terminal structure of a hardware operating environment involved in an embodiment of the present disclosure;

2 is a schematic flowchart of a first embodiment of a malicious sample detection method of the present disclosure;

3 is a schematic diagram of a timeline of a combined scheme for detecting a malicious sample of the present disclosure;

4 is a schematic diagram of functional modules of a malicious sample detection device of the present disclosure.

The implementation, functional characteristics and advantages of the present disclosure will be further described in conjunction with the embodiments and with reference to the drawings.

detailed description

It should be understood that the embodiments described herein are only used to explain the present disclosure and are not intended to limit the present disclosure.

The main solution of the embodiments of the present disclosure is to: start the time-variable mode of the virtual machine, obtain the log of the tested sample in the time-variable mode of the virtual machine; analyze whether the record log in the time-variable mode There is malicious behavior; if there is malicious behavior in the recording log, the type of latent behavior in the time dimension of the tested sample is determined according to the type of the time variable speed mode. The present disclosure realizes that by accelerating the system time lapse of the virtual machine and quickly triggering the time latent behavior of the malicious sample through the time speed change, the efficiency and success rate of the dynamic behavior analysis of the malicious sample are improved.

Due to the dynamic behavior analysis of malicious samples in some cases, it is an analysis method that runs malicious samples in a real computer operating environment and analyzes the log information to identify malicious samples. However, most of the current malware, viruses or backdoors have the latent feature of time dimension, that is, they will not perform malicious operations immediately after infecting the host machine, but will be latent to run for a period of time before performing malicious behavior, dynamic behavior analysis The analysis time is fixed and relatively short, which makes it difficult to capture malicious behaviors of malicious samples, unless a large amount of useless waiting time is consumed to increase the accuracy of analysis in a way that reduces efficiency. Even so, like some with long-term latent behaviors A malicious sample, because it is impossible to wait indefinitely, cannot obtain its malicious behavior.

An embodiment of the present disclosure proposes a solution that can accelerate the system time lapse of a virtual machine, quickly trigger the time latent behavior of malicious samples through time shifting, and improve the efficiency and success rate of malicious sample dynamic behavior analysis.

As shown in FIG. 1, FIG. 1 is a schematic diagram of a terminal structure of a hardware operating environment involved in a solution of an embodiment of the present disclosure.

The terminal of the embodiment of the present disclosure is a malicious sample detection device.

As shown in FIG. 1, the terminal may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to implement connection communication between these components. The user interface 1003 may include a display (Display), an input unit such as a keyboard (Keyboard), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory, or may be a non-volatile memory (non-volatile memory), such as a disk memory. The memory 1005 may optionally be a storage device independent of the foregoing processor 1001.

In one embodiment, the terminal may further include a camera, an RF (Radio Frequency) circuit, a sensor, an audio circuit, a WiFi module, and so on. Among them, sensors such as light sensors, motion sensors and other sensors. In one embodiment, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display screen according to the brightness of the ambient light, and the proximity sensor may turn off the display screen when the terminal device moves to the ear And/or backlight. Of course, the terminal can also be configured with other sensors such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, which will not be repeated here.

A person skilled in the art may understand that the terminal structure shown in FIG. 1 does not constitute a limitation on the terminal, and may include more or less components than those illustrated, or combine certain components, or have different component arrangements.

As shown in FIG. 1, the memory 1005 as a computer storage medium may include an operation terminal, a network communication module, a user interface module, and a malicious sample detection program.

In the terminal shown in FIG. 1, the network interface 1004 is mainly used to connect to the background server and perform data communication with the background server; the user interface 1003 is mainly used to connect to the client (user) and perform data communication with the client; and the processor 1001 can be used to call a malicious sample detection program stored in the memory 1005 and perform the following operations: start the time-variable mode of the virtual machine, obtain a log of the tested sample in the time-variable mode of the virtual machine; analyze in Whether there is malicious behavior in the recording log in the time variable speed mode; if there is malicious behavior in the recording log, the latent behavior type of the time dimension of the tested sample is determined according to the type of the time variable speed mode.

In one embodiment, the processor 1001 may call the malicious sample detection program stored in the memory 1005, and also perform the following operations: set the first start time, the first end time, and the linear speed multiple of the linear shift mode; after the first Start the linear variable speed mode at the beginning; run the virtual machine at a running speed of a preset normal speed linear speed multiple to the first end time; obtain the tested sample at the first start time and the The record log between the first end moments is used as the record log of the tested sample in the linear shift mode.

In one embodiment, the processor 1001 may call the malicious sample detection program stored in the memory 1005, and also perform the following operations: set the second start time, the second end time, the skip time, and the third end of the shift speed change mode Time; start the jump speed change mode at the second start time; control the virtual machine to run over the skip time to the second end time; at the second end time, control the The virtual machine runs at a preset normal rate until the third end time; obtain a log of the tested sample between the second end time and the third end time, as the tested sample changes in the transition Logging in mode.

In one embodiment, the processor 1001 may call the malicious sample detection program stored in the memory 1005, and also perform the following operations: run the virtual machine at a preset normal rate, obtain a log of the tested sample; Whether the log at the normal rate has malicious behavior; if the log at the preset normal rate has malicious behavior, it is determined that the sample under test has no latent behavior in the time dimension; if it does not exist, the steps are executed: Start the time varying mode of the virtual machine, and obtain a log of the tested sample in the time varying mode of the virtual machine.

In one embodiment, the processor 1001 may call a malicious sample detection program stored in the memory 1005, and further perform the following operations: if the recording log exhibits malicious behavior, then obtain the type of the time shift mode; shift according to the time The type of pattern determines the type of latent behavior in the time dimension of the tested sample.

In one embodiment, the processor 1001 may call a malicious sample detection program stored in the memory 1005, and further perform the following operation: if the recorded log does not have malicious behavior, it is determined that the measured sample does not have latent behavior in the time dimension.

According to the technical solution provided by the present disclosure, the malicious sample detection terminal calls the malicious sample detection program stored in the memory 1005 through the processor 1001 to implement the step of starting the time-varying mode of the virtual machine, and obtaining the tested sample in the virtual machine The log in the time-variable mode; analyze whether the log in the time-variable mode has malicious behavior; if the log has malicious behavior, determine the test sample according to the type of the time-variable mode Types of latent behavior in the time dimension. By speeding up the system time lapse of the virtual machine, the present disclosure realizes the time latent behavior of quickly triggering malicious samples through time varying, and improves the efficiency and success rate of malicious sample dynamic behavior analysis.

Based on the above hardware structure, an embodiment of the disclosed malicious sample detection method is proposed.

Referring to FIG. 2, FIG. 2 is a schematic flowchart of a first embodiment of a malicious sample detection method of the present disclosure.

As shown in FIG. 2, the first embodiment of the present disclosure provides a malicious sample detection method. The malicious sample detection method is applied to a virtual machine. The malicious sample detection method includes the following steps:

Step S1, start the time variable mode of the virtual machine, and obtain a log of the tested sample in the time variable mode of the virtual machine;

It can be understood that the malicious sample detection method proposed in the present disclosure is applicable to the technical field of data processing.

In this embodiment, an operating system capable of running a virtual machine is installed in the host host, and then a client system is installed on the virtual machine, and then the host machine transmits the tested sample to the client in the virtual machine through a shared folder端系统。 End system. Among them, as long as the operating system is an operating system supported by the virtual machine, the speed change effect can be achieved, such as windows, linux, etc.

The time shift mode in this embodiment includes a linear shift mode and a jump shift mode.

In one embodiment, linear variable speed refers to increasing or decreasing the system time running rate in the virtual machine, mainly by accelerating the system time flow rate in the virtual machine to accelerate the malicious behavior of triggering the timing-triggered malicious sample. When the time variable speed mode is the linear variable speed mode, the system time flow rate becomes N times the preset normal rate, and at the same time, the running speed of the tested sample in the virtual machine system also becomes N times its running speed in the real world If the tested sample is a time-triggered malicious sample, its malicious behavior in the current virtual machine will be triggered and released in advance, and the malicious behavior will be captured by analyzing the log of the tested sample during the speed change.

Jump speed change refers to jumping the system time in a virtual machine to another future time point in a short time, and is mainly used to accelerate the malicious behavior of triggering a time-triggered malicious sample. When the time variable speed mode is the jump variable speed mode, the system time jumps from the current time point to another future time point in a short time. If the measured sample is a time-triggered malicious sample, when it is determined that the current time point is equal to or greater than At the triggering moment of the malicious sample, the latent condition of the regularly-triggered malicious sample is triggered to release the malicious behavior, and the recorded log of the tested sample after jumping and changing speed is recorded and analyzed, thereby capturing the malicious behavior.

The above two time shift modes can be implemented separately or combined together. The preferred solution of this embodiment is to implement the above two time shift modes in combination.

Among them, the above two ways to change the time running frequency or step value of the virtual machine vary according to the software type of the virtual machine. If the software type of the virtual machine is open source, such as the QEMU virtual machine, you can modify the code module that provides the system clock in the open source code to achieve variable speed; if the software type of the virtual machine is closed source, such as vmware, you can modify config. The parameter host.cpukHz of the ini configuration file achieves the purpose of variable speed; other types of virtual machines without related configuration files can modify the clock frequency of the system clock through reverse engineering to achieve the purpose of variable speed.

Step S2: Analyze whether there is malicious behavior in the recording log under the time variable mode;

Record logs include but are not limited to API call records and call parameters during the running of the tested samples, network access records, strings parsed by malicious samples, domain names, running screenshots, read and write problems, released files, network behaviors, etc. By analyzing the contents of the above log, combined with professional malicious sample malicious behavior judgment rules, malicious behavior judgment can be made.

In step S3, if malicious behavior exists in the recording log, the type of latent behavior in the time dimension of the tested sample is determined according to the type of the time variable speed mode.

By analyzing the contents of the log and combining with professional malicious sample malicious behavior judgment rules, if the detection and analysis finds that there is malicious behavior in the log in the time variable mode, you can judge the type according to the type of time variable mode in which the malicious behavior occurred The type of latent behavior of the tested sample in the time dimension.

Through the malicious sample detection method proposed in this embodiment, the time latent behavior of the malicious sample is quickly triggered by speeding up the system time lapse of the virtual machine through time shifting, and the efficiency and success rate of malicious sample dynamic behavior analysis are improved.

In one embodiment, based on the first embodiment shown in FIG. 2 above, a second embodiment of the malicious sample detection method of the present disclosure is proposed. In this embodiment, the foregoing step S1 further includes:

Step S101: Run the virtual machine at a preset normal rate, and obtain a log of the tested sample in real time;

In this embodiment, before starting the time varying mode of the virtual machine, the virtual machine system can be run at a preset normal rate synchronized with the real-world time lapse speed, and the record of the tested sample at the preset normal rate can be obtained in real time Log.

Step S102: Analyze whether there is malicious behavior in the recording log at a preset normal rate;

Analyze the recording log of the tested sample at the preset normal rate, where the recording log records the API called during the running of the tested sample and its incoming, return parameters, reading and writing problems, the released files, Network behavior, by analyzing the contents of the above log records, combined with professional malicious sample malicious behavior judgment rules, can determine the malicious behavior of the recorded log of the tested sample, thereby determining whether the tested sample has malicious behavior at a preset normal rate .

Step S103, if there is malicious behavior in the recording log at the preset normal rate, it is determined that there is no latent behavior in the time dimension in the tested sample;

If it does not exist, the step is executed: starting the time-variable mode of the virtual machine, and obtaining a log of the tested sample in the time-variable mode of the virtual machine.

If, through analysis, it is found that the tested sample has malicious behavior in the recording log at a preset normal rate, it means that the tested sample is a malicious sample, and since the malicious sample can be triggered at a normal time flow rate, it does not exist The latent behavior in the time dimension, so the tested sample is determined to be a malicious sample without latent behavior in the time dimension. At the same time, if the tested sample is determined to be a malicious sample without latent behavior in the time dimension, it can be stopped at the preset detection stop time This test.

If it is found through analysis that there is no malicious behavior in the log of the tested sample at the preset normal rate, it means that the tested sample may be a non-malicious sample or a malicious sample with latent conditions in the time dimension. , Further detection is required, so step S1 is executed.

The malicious sample detection method proposed in this embodiment realizes that by running the tested sample at a preset normal rate, recording and analyzing the log of the tested sample in the process of running at the preset normal rate, so that there is no latent time dimension Malicious samples of behavior are detected, avoiding the use of subsequent variable speed steps, to achieve the effect of improving analysis efficiency.

In one embodiment, based on the first embodiment shown in FIG. 2 above, a third embodiment of the malicious sample detection method of the present disclosure is proposed. In this embodiment, the time shift mode includes a linear shift mode, before step S1 above Also includes:

Step S101: Set the first start time, the first end time and the linear speed multiple of the linear shift mode;

To change the system time in the virtual machine system, you must first set the starting operation time of the linear transmission mode, that is, the first start time TLstart, the ending operation time of the linear transmission mode, that is, the first end time TLstop, the virtual machine system time The multiple of the running speed relative to the real-world time lapse speed, that is, the linear shift multiple N.

Among them, TLstart and TLstop are real-world time. After the linear speed change, the time that the virtual machine system experiences during the linear speed change mode is N*(TLstart-TLstop), the virtual machine system corresponding to the first end time Time=TLstart+N*(TLstop-TLstart).

N value is a positive floating point number, the theoretical value range is 0 ~ +∞.

When N is equal to 0, the time in the virtual machine system no longer increases, the operation of the virtual machine system stops, and the system time stops; when N is greater than 0 and N is less than 1, the virtual machine system runs slower, and the virtual machine system time is relatively real World time becomes slow; when N equals 1, the virtual machine system runs normally, and the virtual machine system time equals the real world time; when N is greater than 1, the virtual machine system runs faster, and the virtual machine system time becomes faster relative to the real world time.

In this embodiment, the linear shift mode is preferably N greater than 1.

In one embodiment, the above step S1 includes: step S11, starting the linear speed change mode at the first starting time; step S12, running the virtual machine to the virtual machine at a running speed of a preset normal speed linear speed multiple The first end time; step S13, obtaining in real time a recording log of the tested sample between the first starting time and the first ending time, as a recording log of the tested sample in the linear shift mode .

At the first starting time, TLstart automatically triggers the operation of the linear variable speed mode, runs the virtual machine to TLstop at an operating rate of N times the real-world time lapse speed, and obtains the log of the tested sample during the linear speed change, that is, between TLstart and TLstop The recorded log is used as the recorded log of the tested sample in the linear variable speed mode.

Through the malicious sample detection method proposed in this embodiment, the tested sample is run at a variable speed in the virtual machine system, and the log of the tested sample during the running at a variable speed is recorded and analyzed, thereby providing support for subsequent malicious behavior analysis.

In one embodiment, based on the first embodiment shown in FIG. 2 above, a fourth embodiment of the malicious sample detection method of the present disclosure is proposed. In this embodiment, the time shift mode includes a jump shift mode, and the above step S1 It also includes:

Step S101: Set the second start time, the second end time, the skip time, and the third end time of the jump speed change mode;

To change the system time in the virtual machine system, you must first set the initial running time of the jump speed mode, that is, the second start time TJstart, the end running time of the jump speed mode, that is, the second end time TJstop, virtual The time skipped by the machine system time, namely the skip time △T, and the end time of the tested sample in the log information recording after the jump speed change mode, that is, the third end time Tstop, which is composed of the second start time and the skip time Obtain the jump landing time = the first starting time TJstart + skip time ΔT.

Among them, TJstart, TJstop, and Tstop are real-world time, and the jump landing point is the virtual system time point after the virtual machine system time passes the jump.

△T is a positive floating-point number, and the theoretical value range is 0 ~ +∞.

In one embodiment, the above step S1 includes: step S14, starting the jump speed change mode at the second starting moment; step S15, controlling the virtual machine to run to the Second end time; Step S16, at the second end time, control the virtual machine to run at a preset normal rate to the third end time; Step S17, obtain the tested sample at the second end time and all The record log between the third end times is used as the record log of the tested sample in the jump speed change mode.

At the second start time TJstart automatically triggers the running jump speed change mode, controls the virtual machine to jump from the second end time TJstop to the jump landing point time, and at TJstop controls the virtual machine to run at a preset normal rate to the third end time Tstop, Obtain the test log of the tested sample after the jump and shift process, that is, the log between TJstart and Tstop, as the test log in the jump and shift mode. The reason for not recording and analyzing the dynamic behavior of the tested sample during the jump speed change process (ie, TJstart to TJstop) is because the time that the virtual machine system has jumped may be very long. If you want to test the sample during this process, The recording and analysis of dynamic behavior consumes a lot of resources, which is contrary to the original intention of the present disclosure. Therefore, only the recording log of the tested sample after the jump and variable speed process is recorded and obtained.

Wherein, the virtual machine system time corresponding to the second end time = first start time + skip time, and the virtual machine system time corresponding to the third end time = first start time + skip time + ( Three end moments-second end moment).

The malicious sample detection method provided in this embodiment implements variable-speed running of the tested sample in the virtual machine system, and records and analyzes the log of the tested sample after the transition of the variable-speed running process, thereby providing support for subsequent malicious behavior analysis.

The third embodiment and the fourth embodiment can be implemented separately, that is, in the virtual machine system, the linear speed change mode or the jump speed change mode is run separately; the two embodiments can also be implemented in combination, for example, as shown in FIG. 3, In the virtual machine system, you can run the linear variable speed mode first. If no malicious behavior is detected in the tested sample through the linear variable speed mode, then run the variable speed mode to TJstop, and then run the virtual machine system to the third normal speed At the end time Tstop, no matter whether the malicious behavior of the tested sample is detected at this time, the detection is stopped, and the detection analysis report is fed back to avoid waste of resources.

In addition, regardless of whether the third embodiment is implemented separately and the fourth embodiment is implemented separately or a combination of the two, the process of running at the preset normal rate can be interspersed before and after running the linear shift mode and the jump shift mode. Not limited here.

In one embodiment, based on the first embodiment shown in FIG. 2 above, a fifth embodiment of the malicious sample detection method of the present disclosure is proposed. In this embodiment, the above step S2 further includes:

Step S21: If there is no malicious behavior in the recording log, it is determined that there is no latent behavior in the time dimension in the tested sample.

In the virtual machine system, the linear variable speed mode or the single jump variable speed mode can be run separately, or a combination of the two embodiments can be implemented. If after the above various modes, no malicious behavior of the tested sample is detected, the judgment is determined It is stated that there is no probability of latent behavior in the time dimension of the tested sample.

The above step S3 includes: step S31, if there is malicious behavior in the recording log, the type of the time variable speed mode is acquired; step S32, the type of the time dimension latent behavior of the tested sample is determined according to the type of the time variable speed mode .

In one embodiment, if there is malicious behavior in the log, first obtain the type of the time variable mode in the virtual machine system, and then determine whether the type of latent behavior in the time dimension of the sample under test is time-triggered or time-triggered according to the type of time-variable mode .

Through the malicious sample detection method proposed in this embodiment, a qualitative determination of the latent condition type of the time dimension of the malicious sample is achieved, and the effect of improving the analysis efficiency is achieved.

The technical solution proposed by the embodiments of the present disclosure solves the dynamic behavior analysis of malicious samples in some cases. It is an analysis method that runs malicious samples in a real computer operating environment and analyzes log information to identify malicious samples. However, most of the current malware, viruses or backdoors have the latent feature of time dimension, that is, they will not perform malicious operations immediately after infecting the host machine, but will be latent to run for a period of time before performing malicious behavior, dynamic behavior analysis The analysis time is fixed and relatively short, which makes it difficult to capture malicious behaviors of malicious samples, unless a large amount of useless waiting time is consumed to increase the accuracy of analysis in a way that reduces efficiency. Even so, like some with long-term latent behaviors A malicious sample, because it is impossible to wait indefinitely, cannot obtain its malicious behavior.

Refer to FIG. 4, which is a schematic diagram of functional modules of the present disclosure.

The present disclosure also provides a scanning device. The scanning device includes: an acquisition module 10 that starts a time-variable mode of the virtual machine to obtain a log of a tested sample in the time-variable mode of the virtual machine; an analysis module 20 To analyze whether the recorded log in the time variable speed mode has malicious behavior; the determination module 30, if the recorded log has malicious behavior, determine the time dimension latent behavior of the tested sample according to the type of the time variable speed mode Types of.

The implementation of the malicious sample detection and detection device of the present disclosure is basically the same as the embodiments of the malicious sample detection method, and details are not described herein again.

The present disclosure provides a storage medium that stores one or more programs, and the one or more programs may also be executed by one or more processors to implement any of the above Steps of malicious sample detection method.

The embodiments of the storage medium of the present disclosure are basically the same as the embodiments of the malicious sample detection method, which will not be repeated here.

It should be noted that in this article, the terms "include", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal that includes a series of elements includes not only those elements, It also includes other elements that are not explicitly listed, or include elements inherent to this process, method, article, or terminal. Without more restrictions, the element defined by the sentence "include one..." does not exclude that there are other identical elements in the process, method, article, or terminal that includes the element.

The sequence numbers of the above-mentioned embodiments of the present disclosure are for description only, and do not represent the merits of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the methods in the above embodiments can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware, but in many cases the former is better Implementation. Based on such an understanding, the technical solutions of the present disclosure can be embodied in the form of software products in essence or in some cases, and the computer software products are stored in a storage medium (such as ROM/RAM, The magnetic disk and the optical disk) include several instructions to enable a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to perform the methods described in the embodiments of the present disclosure.

The malicious sample detection method, device, system and storage medium proposed by the present disclosure obtain the log of the tested sample in the time-varying mode of the virtual machine by starting the time-varying mode of the virtual machine; Whether the recording log under the variable speed mode has malicious behavior; if the recording log has malicious behavior, determine the type of latent behavior in the time dimension of the tested sample according to the type of the time variable speed mode. By speeding up the system time lapse of the virtual machine, the present disclosure realizes the time latent behavior of quickly triggering malicious samples through time shifting, and improves the efficiency and success rate of malicious sample dynamic behavior analysis.

The above are only preferred embodiments of the present disclosure and do not limit the patent scope of the present disclosure. Any equivalent structure or equivalent process transformation made by using the contents of the specification and drawings of the present disclosure, or directly or indirectly used in other related technical fields , The same reason is included in the scope of patent protection of this disclosure.

Claims

A malicious sample detection method, wherein the malicious sample detection method is applied to a virtual machine, and the malicious sample detection method includes the following steps:

Start the time-variable mode of the virtual machine, and obtain a log of the tested sample in the time-variable mode of the virtual machine;

Analyze whether there is malicious behavior in the recording log under the time variable mode;

If there is malicious behavior in the recording log, the type of latent behavior in the time dimension of the tested sample is determined according to the type of the time variable speed mode.
The malicious sample detection method according to claim 1, wherein the time-variable mode includes a linear-variable mode, the time-variable mode of starting the virtual machine, and acquiring the tested sample under the time-variable mode of the virtual machine The steps before logging include:

Set the first start time, the first end time and the linear speed multiple of the linear shift mode;

The step of starting the time varying mode of the virtual machine and obtaining a log of the tested sample in the time varying mode of the virtual machine includes:

Starting the linear shift mode at the first starting moment;

Running the virtual machine at a running speed of a linear speed multiple of a preset normal speed to the first end time;

Obtain a record log of the tested sample between the first start time and the first end time as a record log of the tested sample in the linear shift mode.
The malicious sample detection method according to claim 1, wherein the time variable speed mode includes a jump variable speed mode, the time variable speed mode of starting the virtual machine, and a time variable speed mode of acquiring the tested sample in the virtual machine The steps under the logging before include:

Set the second start time, the second end time, the skip time and the third end time of the jump speed change mode;

The step of starting the time varying mode of the virtual machine and obtaining a log of the tested sample in the time varying mode of the virtual machine includes:

Starting the jump speed change mode at the second starting moment;

Controlling the virtual machine to skip the skip time to run to the second end time;

At the second end time, controlling the virtual machine to run at the preset normal rate until the third end time;

Obtain a record log of the test sample between the second end time and the third end time as a record log of the test sample in the jump speed change mode.
The malicious sample detection method according to claim 2 or 3, wherein the step of starting the time-varying mode of the virtual machine and obtaining a log of the tested sample in the time-varying mode of the virtual machine further includes :

Running the virtual machine at the preset normal rate to obtain a log of the tested sample;

Analyze whether the recorded logs at the preset normal rate have malicious behavior;

If there is malicious behavior in the recording log at the preset normal rate, it is determined that there is no latent behavior in the time dimension in the tested sample;

If it does not exist, the step is executed: starting the time-variable mode of the virtual machine, and obtaining a log of the tested sample in the time-variable mode of the virtual machine.
The method for detecting a malicious sample according to claim 2 or 3, wherein if the recording log has malicious behavior, the step of determining the type of latent behavior in the time dimension of the sample under test according to the type of the time shift mode include:

If there is malicious behavior in the recording log, the type of the time variable mode is acquired;

The type of latent behavior in the time dimension of the tested sample is determined according to the type of the time variable speed mode.
The malicious sample detection method according to claim 1, wherein the step of analyzing whether there is malicious behavior in the recording log in the time varying mode further comprises:

If there is no malicious behavior in the recording log, it is determined that there is no latent behavior in the time dimension in the tested sample.
The malicious sample detection method according to claim 2, wherein the first start time and the first end time are real-world time, and the virtual machine system time corresponding to the first end time = first start time + linear Variable speed multiple × (first end time-first start time).
The malicious sample detection method according to claim 3, wherein the second start time, second end time, and third end time are real-world time, and the virtual machine system time corresponding to the second end time = The second start time + skip time, the virtual machine system time corresponding to the third end time = second start time + skip time + (third end time-second end time).
A malicious sample detection device, wherein the malicious sample detection device includes:

An obtaining module, starting the time-variable mode of the virtual machine, and obtaining a log of the tested sample in the time-variable mode of the virtual machine;

The analysis module analyzes whether the recorded log in the time variable speed mode has malicious behavior;

The judging module, if there is malicious behavior in the recording log, judges the type of latent behavior in the time dimension of the tested sample according to the type of the time variable speed mode.
A malicious sample detection system, wherein the malicious sample detection system includes: a memory, a processor, and a malicious sample detection program stored on the memory and executable on the processor, the malicious sample detection program being The processor executes the steps of the malicious sample detection method according to any one of claims 1 to 8 when executed.
A storage medium, wherein a malicious sample detection program is stored on the storage medium, and when the malicious sample detection program is executed by a processor, the steps of the malicious sample detection method according to any one of claims 1 to 8 are implemented .